Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DuckDuckGo browser seemingly sends domains a user visits to DDG servers

github.com

Post reply on HN
Print view View original

121–130 of 531 posts

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#121

Post by [deleted] »

tagawa wrote: post #81
fiddlerwoaroof wrote: post #56

Earlier quoted context omitted.

This doesn’t make sense for a browser: just embed the service’s logic in the browser, the browser has all the same information the service could get.

We had already had created this anonymous favicon service for our private search engine. In addition, doing it this way avoids another request (and potentially multiple) to the end site. The service is private as we do not collect any personal information (e.g. IP addresses) on any requests for this or any service and the requests are all end-to-end encrypted.

[deleted]

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#122

Post by santraginean »

tagawa wrote: post #81
fiddlerwoaroof wrote: post #56

Earlier quoted context omitted.

This doesn’t make sense for a browser: just embed the service’s logic in the browser, the browser has all the same information the service could get.

We had already had created this anonymous favicon service for our private search engine. In addition, doing it this way avoids another request (and potentially multiple) to the end site. The service is private as we do not collect any personal information (e.g. IP addresses) on any requests for this or any service and the requests are all end-to-end encrypted.

Surely you could fetch the favicon asynchronously and update the address bar or tabs or wherever you display it only after the other assets are loaded? It’s not like the DOM has elements that depend on it. This is a really, really weird hill to die on.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#123

Post by pwdisswordfish2 »

bscphil wrote: post #102
pwdisswordfish2 wrote: post #58

Earlier quoted context omitted.

"This is not to say that DDG is perfect: links you click do seem to be redirected through a /l/ page on their domain ..." I am surprised the user is not complaining about this instead of the favicons. Their privacy policy goes on about the privacy implications of Referer headers and instead of calling out browsers for sending Referer by default, they instead give themselves power to record all the user's clicked resu…

This is done only for browsers that don't support setting the referrer policy. https://caniuse.com/referrer-policy . It should not be happening with any modern browser, and (like the other reply) I don't see it in mine (Firefox). See here: https://help.duckduckgo.com/results/rduckduckgocom/

Are you saying DDG is forcing you to send a User-Agent header?

DDG's privacy policy also goes on about the privacy implications of User-Agent headers combined with IP addresses.

So let's say I take what they have put in their privacy policy to heart and I stop sending a User-Agent header. In response DDG sends prefixed result URLs? WTF?

Using haproxy, for example, I can use a "modern browser" and send no User-Agent header. I still get prefixed result URLs.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#124

Post by Torn »

dabbernaught420 wrote: post #104
CivBase wrote: post #8

This is a bad look for a company that is trying to build its brand on privacy and trust. Even though I don't use the DDG browser I hope they own up to this, rectify it quickly, and learn from it.

In my view, anyone who trusts ddg is a bit silly - founder has a bad track record on user privacy. Founded Names Database[1], a social media website designed to collect user information as aggressively as possible, before selling all the information to classmates.com. [1] https://en.wikipedia.org/wiki/Names_Database

https://en.wikipedia.org/wiki/Ad_hominem

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#125

Post by Thorrez »

NotSammyHagar wrote: post #108
tagawa wrote: post #52

DuckDuckGo staff here. As mentioned in the linked page, the purpose of the request is to retrieve a website's favicon so that it can be displayed in certain places within the app or on the results page. We use an internal favicon service because it can be complicated to locate a favicon for a website. They can be stored in a variety of locations and in a variety of formats. The service understands these edge cases an…

I appreciate you answering, probably knowing you'd face some negative feedback. Saying "we should trust you, it's for a good reason" is what google and everyone else says. You'll be better off if you just end this. The loss of the fav icon is less important than keeping your credibility.

> is what google and everyone else says.

Do Chrome, Firefox, or Safari do this? I would assume they do it on-device.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#126

Post by TedDoesntTalk »

ajnin wrote: post #89
tagawa wrote: post #52

DuckDuckGo staff here. As mentioned in the linked page, the purpose of the request is to retrieve a website's favicon so that it can be displayed in certain places within the app or on the results page. We use an internal favicon service because it can be complicated to locate a favicon for a website. They can be stored in a variety of locations and in a variety of formats. The service understands these edge cases an…

You really can't use "we promise we won't misuse the information" as an argument, that's what everyone says whether it's true or not, and the whole point of using a privacy-centric browser is that as a user you can't trust those kinds of promises.

> You really can't use "we promise we won't misuse the information" as an argument

Sure they can. Doesn’t mean you have to believe them.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#128

Post by ViViDboarder »

tagawa wrote: post #52

DuckDuckGo staff here. As mentioned in the linked page, the purpose of the request is to retrieve a website's favicon so that it can be displayed in certain places within the app or on the results page. We use an internal favicon service because it can be complicated to locate a favicon for a website. They can be stored in a variety of locations and in a variety of formats. The service understands these edge cases an…

Complicated code can run just fine on device.

I’ve been an avid DDG user for years and it worries me that DDG staff don’t see why this is an issue. We shouldn’t have to trust your privacy policy if you minimize exposure.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#129

Post by Thorrez »

Torn wrote: post #124
dabbernaught420 wrote: post #104

Earlier quoted context omitted.

In my view, anyone who trusts ddg is a bit silly - founder has a bad track record on user privacy. Founded Names Database[1], a social media website designed to collect user information as aggressively as possible, before selling all the information to classmates.com. [1] https://en.wikipedia.org/wiki/Names_Database

https://en.wikipedia.org/wiki/Ad_hominem

I don't really think is an ad hominem fallacy. An ad homihem fallacy is when you attack the person making an argument rather than the argument. But no one here is attacking the people making the argument.

The argument is "Trust DDG". That argument is being attacked as "DDG's founder has done bad stuff in the past, it's likely DDG will do bad stuff, so I won't trust it". That seems to be attacking the argument to me, thus not an ad hominem.

Re: DuckDuckGo browser seemingly sends domains a user visits to DDG servers

#130

Post by ViViDboarder »

dabbernaught420 wrote: post #104
CivBase wrote: post #8

This is a bad look for a company that is trying to build its brand on privacy and trust. Even though I don't use the DDG browser I hope they own up to this, rectify it quickly, and learn from it.

In my view, anyone who trusts ddg is a bit silly - founder has a bad track record on user privacy. Founded Names Database[1], a social media website designed to collect user information as aggressively as possible, before selling all the information to classmates.com. [1] https://en.wikipedia.org/wiki/Names_Database

Still a better track record than Google, so...
Post reply on HN